Storage of File with Sensitive Data Under Web Root
The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
Besides public-facing web pages and code, products may store sensitive data, code that is not directly invoked, or other files under the web document root of the web server. If the server is not configured or otherwise used to prevent direct access to those files, then attackers may obtain this sensitive data.
Weaknesses in this category are related to exposed resource.
Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2021.
Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have th...
This view (slice) covers all the elements in CWE.
This view (slice) lists weaknesses that can be introduced during implementation.